Light

Episode #1059 Quiz

MongoBleed
Date: 2026-01-06 | Length: 2.75 hrs | Episode page at twit.tv

About this episode

Security Now! Episode 1059 discusses the significant MongoBleed vulnerability (CVE-2025-14847) affecting all MongoDB versions since 3.6, allowing unauthenticated remote attackers to exfiltrate uninitialized server memory due to improper decompressed payload size validation in Zlib.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the primary security rationale given by the CA/Browser Forum for reducing the maximum lifetime of code signing certificates from 39 months to 15 months starting March 1, 2026?

Question 1

What was the primary security rationale given by the CA/Browser Forum for reducing the maximum lifetime of code signing certificates from 39 months to 15 months starting March 1, 2026?

No apparent security reason; the reduction was made despite hardware protections and primarily benefits certificate authorities financially. To prevent theft of code signing certificates by requiring more frequent key rotation. To eliminate the ability of malicious actors to use stolen certificates for long periods by enforcing quick revocation. To align code signing certificate lifetimes with web server TLS certificate lifetimes for better security compatibility.

Question 2: In the context of MongoBleed (CVE-2025-14847), what specific programming mistake in MongoDB's handling of compressed messages led to the vulnerability?

Question 2

In the context of MongoBleed (CVE-2025-14847), what specific programming mistake in MongoDB's handling of compressed messages led to the vulnerability?

Failure to check the actual decompressed size against the claimed decompressed size leading to returning uninitialized heap memory. Use of a deprecated cryptographic library causing buffer overflows during TLS communication. Incorrect permission settings on MongoDB configuration files exposing private keys to unauthorized users. Insufficient authentication checks before allowing write access to the database files.

Question 3: Why does Smart App Control (SAC) in Windows 11 represent a significant change in user control over application trust?

Question 3

Why does Smart App Control (SAC) in Windows 11 represent a significant change in user control over application trust?

SAC only applies to apps downloaded from the Microsoft Store and ignores others. SAC cannot be disabled once enabled, and users cannot add exceptions for apps they trust. SAC allows users to whitelist any unsigned app and bypass code signing requirements easily. SAC enforces mandatory two-factor authentication for all new software installations.

Question 4: What security enhancement did the Python Package Index (PyPI) implement in 2025 to combat phishing attacks exploiting two-factor authentication (2FA)?

Question 4

What security enhancement did the Python Package Index (PyPI) implement in 2025 to combat phishing attacks exploiting two-factor authentication (2FA)?

Complete removal of TOTP-based 2FA in favor of SMS-based codes only. Switching all users to single sign-on (SSO) authentication with third-party providers. Mandatory hardware security keys (FIDO2) for all user logins. Adding an email verification step for TOTP-based two-factor authentication to verify logins from trusted devices.

Question 5: According to the episode, what is the most significant policy failure that allowed MongoBleed to affect over 87,000 publicly reachable MongoDB instances?

Question 5

According to the episode, what is the most significant policy failure that allowed MongoBleed to affect over 87,000 publicly reachable MongoDB instances?

Default MongoDB configuration requires exposing TCP port 27017 publicly without firewall restrictions. Lack of effective intrusion detection systems on MongoDB servers to alert admins of in-memory data exfiltration attempts. Relying solely on database authentication mechanisms while unnecessarily exposing MongoDB instances publicly to the internet. Using an outdated version of MongoDB that lacks the latest TLS encryption support for its wire protocol.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.